Ekubo Protocol suffers vulnerability attack on Ethereum

According to ME News, on May 6th (UTC+8), security firm Blockaid reported that a custom extension contract of the Ekubo Protocol on Ethereum was exploited, resulting in approximately $1.4 million in losses. The vulnerability stemmed from the extension contract's failure to verify whether the payer was the lock initiator or authorized payer when executing payment callbacks. This allowed attackers to transfer funds from users who had granted ERC-20 allowances to the contract via `transferFrom`. Currently, only users who have authorized this v2 contract as a sender are at risk. (Source: ME)